Sometimes, it's practical to skip all signature checks, e.g. when
building from a Debian ISO image which doesn't contain a signed Release
file.

Add the `--no-check-gpg` and `--check-gpg` flags, the latter is set per
default.